Data Processing Addendum

Capitalized terms have the meanings given in this DPA or, if not defined here, in the Terms of Service. “Personal Information” means information relating to an identified or identifiable individual that Pinstripe processes on the Organization's behalf. “Subprocessor” means a third party engaged by Pinstripe to process Personal Information on the Organization's behalf.

This DPA applies to Personal Information Pinstripe processes on the Organization's behalf in providing the service, and does not apply to information Pinstripe processes as a controller for its own purposes (see the Privacy Policy).

For Personal Information the Organization uploads or generates in the platform, the Organization is the controller or business, and Pinstripe is the processor or service provider acting on the Organization's documented instructions.

Pinstripe processes Personal Information only as needed to provide the service, as further documented in these Terms and this DPA, and as reasonably instructed by the Organization through its use of the platform.

Pinstripe ensures that personnel authorized to process Personal Information are bound by appropriate confidentiality obligations.

Pinstripe maintains reasonable administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized or unlawful processing, loss, alteration, disclosure, or access. Current controls are summarized on our Security Overview.

The Organization authorizes Pinstripe to engage subprocessors to provide the service. Our current list is at Subprocessors. When we intend to add or replace a subprocessor, we will update the list. An Organization that has subscribed to change notifications may object to a new subprocessor within fifteen (15) days of the update by contacting us; if we cannot address a reasonable objection, the Organization may terminate the affected portion of the service.

Taking into account the nature of the processing, Pinstripe will provide the Organization with reasonable assistance to enable it to respond to requests from individuals exercising rights under applicable law.

Pinstripe will notify the Organization without undue delay after becoming aware of a confirmed personal-information breach affecting the Organization's Personal Information, and will provide information reasonably necessary for the Organization to meet its own notification obligations.

At the Organization's written request on termination of the service, Pinstripe will return or delete Personal Information processed on the Organization's behalf, subject to retention required by law and to standard vendor-managed backups.

Pinstripe will make available information reasonably necessary to demonstrate compliance with this DPA, including responses to reasonable written questionnaires and, where available, third-party attestations.

If a legally binding request for Personal Information is made by a government authority, Pinstripe will, unless prohibited, provide the Organization with reasonable notice so the Organization may seek a protective order or other relief.

The service is currently operated from the United States. This DPA does not attach international transfer mechanisms such as the Standard Contractual Clauses. If the parties later determine that such mechanisms are required, they will execute an amendment.

Pinstripe does not offer a HIPAA Business Associate Agreement and is not designed for the storage or processing of protected health information, government identifiers, or the other restricted data categories described in the Terms of Service.

In the event of a conflict, the order of precedence is: this DPA, then the Terms of Service, then the other referenced policies.

The liability provisions of the Terms of Service apply to this DPA.

This DPA remains in force for so long as Pinstripe processes Personal Information on the Organization's behalf.

Categories of data subjects: the Organization's authorized users, employees, customers, and customer-portal visitors.

Categories of Personal Information: as described in the Privacy Policy.

Processing activities: hosting, storage, transmission, display, backup, and support of the service.

Duration: for the term of the service, subject to retention exceptions.

Security measures: as summarized on the Security Overview.

Approved subprocessors: as listed on the Subprocessor page.